Powershell throws error with Get-ADPrincipleGroup

user_4464356 0
Viewed 3091

Hoping someone maybe able to help with the below error i get when running a powershell script i created. It worked before fine no issues.

"The Operation being Requested was not performed because the user has not been authenticated."

So the account is permissoned fine and i can run various commands fine in PS. The script works fine on another users machine no issues. I can get around the error with -ResourceContextServer parameter but this is not ideal as this is part of a gui which will look at another domain on top of Domain A. So i use that it will not search Domain B when prompted.

Google has given me little insight although i found on thing which i tried and it worked for a period then i get the same again

$PSDefaultParameterValues.Add('Get-ADPrincipalGroupMembership:Server',"$((Get-ADDomain).PDCEmulator)")

The command that is causing the issues is Get-ADPrincipalGroupMembership running in PS on it own i get the same. Running other commands is fine and no issues.

Anyone else seen this and have solution. It is making things hard when i want to update the script and test it.

Thanks

powershell active-directory
3 Answers

This problem happens if you have disabled account delegation on your admin account which is a security best practice. It means your user account credentials cannot be forwarded to a second computer. When I run Set-Aduser joe.bloggs -accountnotdelegated $false Then the Get-ADPrincipalGroupMembership cmd works fine. If set to false then i get the user not authenticated error. You got the workaround is to use ResourceContextServer

user_176081520

We got this working by repassing the credential with the call to Get-AdPrincipalGroupMembership. It's a bit painful to recredential every time, but if you cache the credential it makes it easier.

user_60431700

This worked for me (30.08.22): Following from 2ps solution above, explicitly run powershell as your domain account (even if already logged in with it..) and run Get-AdPrincipalGroupMembership from there... Disabling delegation made no difference.

user_198786090
Related